Add Let's Encrypt HTTP Challenge #2701

juliens · 2018-01-12T15:07:01Z

What does this PR do?

Until now, Træfik only allowed TLS-SNI-01 and DNS-01 challenges to generate/renew ACME certificates.
This PR allows users to generate/renew ACME certificates thanks to the HTTP-01 challenge.

Motivation

Due to a security vulnerability, Let's Encrypt disabled TLS-SNI-01 challenges.
More information here and here.

Fixes #1832

More

Added/updated tests
Added/updated documentation

Additional Notes

For now, TLS-SNI-01 stays the default challenge in Træfik. If this challenge becomes definitively disabled, it will be removed from Træfik in future versions.
HTTP-01 challenge requires an HTTP entry point which can be accessed through the port 80 by Let's Encrypt.
The acme configuration has to evolve in Træfik, many fields will be deprecated by this PR.

emilevauge

Great job !
Few comments though ;)

emilevauge · 2018-01-12T15:14:57Z

acme/acme.go

+}
+
+type DNSChallenge struct {
+ DNSProvider string `description:"Use a DNS based challenge provider rather than HTTPS."`


s/DNSProvider/Provider

emilevauge · 2018-01-12T15:16:34Z

acme/acme.go

+}
+
+type HTTPChallenge struct {
+ EntryPoint string `description: "HTTP EntryPoint for challenge to"`


HTTP EntryPoint for challenge to => HTTP challenge EntryPoint

emilevauge · 2018-01-12T15:18:53Z

acme/acme.go

+ router.Methods(http.MethodGet).Path(acme.HTTP01ChallengePath("{token}")).Handler(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+ vars := mux.Vars(req)
+ if token, ok := vars["token"]; ok {
+ domain, _, _ := net.SplitHostPort(req.Host)


err should not be ignored

emilevauge · 2018-01-12T15:25:17Z

acme/account.go

@@ -24,6 +24,7 @@ type Account struct {
 PrivateKey []byte
 DomainsCertificate DomainsCertificates
 ChallengeCerts map[string]*ChallengeCert
+ HttpChallenge map[string]map[string][]byte


We really need to add an integration test to check that we support old acme.json.

emilevauge · 2018-01-12T15:31:03Z

acme/acme.go

@@ -155,7 +196,8 @@ func (a *ACME) CreateClusterConfig(leadership *cluster.Leadership, tlsConfig *tl
 }

 a.store = datastore
- a.challengeProvider = &challengeProvider{store: a.store}
+ a.challengeTLSProvider = &challengeTLSProvider{store: a.store}
+ a.challengeHTTPProvider = &challengeHTTPProvider{store: a.store}


I'm not in love with instantiating challengeTLSProvider & challengeHTTPProvider here.

emilevauge · 2018-01-12T15:38:05Z

acme/acme.go

+ if a.OnDemand {
+ log.Warn("ACME.OnDemand is deprecated")
+ }
+


I would use SetEffectiveConfiguration() to initialize the configuration correctly instead of init()

dfeyer · 2018-01-12T22:16:32Z

Based on https://community.letsencrypt.org/t/2018-01-11-update-regarding-acme-tls-sni-and-shared-hosting-infrastructure/50188 I think you can change the default ...

And a huge thanks for your reactivity to implement HTTP-01

Luit · 2018-01-13T01:48:56Z

docs/user-guide/examples.md

 caServer = "http://172.18.0.1:4000/directory"
 entryPoint = "https"
+ [acme.dsnChallenge]


markuslackner · 2018-01-13T13:54:54Z

This fix does not work for me. I get Error while ACME challenge: address test.test.at: missing port in address. I took a quick look into the code and think: In acme.go

domain, _, err := net.SplitHostPort(req.Host)

is getting only the host without port and failing. So for now i'm stuck. I have no idea, why this is not working for me, but obviously works for others. My setup is quite basic: traefik on docker with no special thinks (i reduced the config mostly to the basic example).

ldez · 2018-01-13T14:16:17Z

@markuslackner Could you go to the Traefik community Slack in the channel #support and give more information about your configuration.

Edit: the problem is now fixed 🎉

mhajder · 2018-01-15T20:00:26Z

The official unofficial image.
Use from here: https://hub.docker.com/r/containous/traefik/
docker pull containous/traefik:latest

kruemelro · 2018-01-15T20:36:55Z

I'm still getting the
acme: Could not determine solvers
Error with the latest Version. Did i've overseen something?

mhajder · 2018-01-15T20:41:07Z

@kruemelro Remember to download a new image and clear the cache.
Do not forget to add:

[acme.httpChallenge]
entryPoint = "http"

to config file (traefik.toml)

ldez · 2018-01-15T20:42:21Z

The documentation http://v1-5.archive.docs.traefik.io/configuration/acme/#acmehttpchallenge

Please don't use containous/traefik:latest

mhajder · 2018-01-15T20:48:19Z

@ldez Currently it is the only way because Docker has not yet released a new version of the official image.

ldez · 2018-01-15T21:00:46Z

I know but we don't recommend the use of this image.

ldez · 2018-01-15T21:57:50Z

The official image is available: docker pull traefik:v1.5.0-rc5

hugglesfox · 2018-01-15T22:06:32Z

@ldez When I try run docker pull traefik:v1.5.0-rc5 on my raspberry pi I get ERROR: no matching manifest for linux/arm in the manifest list entries.

ldez · 2018-01-15T22:14:35Z

@HUg0005 I think some images are still under construction, you need to wait.
If you always have this problem in 3-4 hours, come on the Traefik community Slack to inform us.

alexandre-leites · 2018-01-15T23:31:58Z

Hi,

I'm following this PR since the beginning. Thanks all for the efforts. Can I still use the redirection to https entrypoint enabled on the http entrypoint or it won't work properly with the HTTP-01 validation?

If no, how can I redirect anything besides the validation to https entrypoint?

Thanks.

ldez · 2018-01-15T23:43:06Z

@xalexslx you can still use the redirection.

signaleleven · 2018-01-16T11:49:15Z

Just rebuilt my container with traefik:1.5 and the new acme config: works like a charm.
THANKS to everyone involved, it's been a pleasure seeing the project reacting to this. I'm humbled by such awesomeness. You guys rock.

vrosales · 2018-01-16T13:33:39Z

Hi, i am getting 400/timeout when enabling HTTP-01, is there anything else i am supposed to do beside enabling the challenge?

time="2018-01-16T13:28:28Z" level=error msg="Error getting ACME certificates [staging2.example.com] : cannot obtain certificates map[staging2.example.com:acme: Error 400 - urn:acme:error:connection - Fetching http://staging2.example.com/.well-known/acme-challenge/Gw8J6YHJRYT6Tokf3moo8WzzdHuOXe9qcofZ38KuPpk: Timeout
Error Detail:
    Validation for staging2.example.com:80
    Resolved to:
	    XX.XX.XX.XX
    Used: XX.XX.XX.XX

nmengin · 2018-01-16T14:00:36Z

@vrosales Can you come on the Traefik community Slack to give us more information about your configuration?

ldez · 2018-01-20T21:58:32Z

Due to the number of question about redirection:

The redirection is fully compatible with the HTTP-01 challenge.

You can use redirection with HTTP-01 challenge without problem.

Enjoy 🎉

juliens added kind/enhancement a new or improved feature. status/2-needs-review WIP area/acme labels Jan 12, 2018

traefiker added the size/M label Jan 12, 2018

traefiker added this to the 1.5 milestone Jan 12, 2018

ldez changed the title ~~Add HTTP Challenge~~ Add ACME HTTP Challenge Jan 12, 2018

juliens force-pushed the challenge-http branch from 46e264e to 735d199 Compare January 12, 2018 15:32

emilevauge requested changes Jan 12, 2018

View reviewed changes

traefiker added the contributor/waiting-for-corrections label Jan 12, 2018

ldez changed the title ~~Add ACME HTTP Challenge~~ Add Let's Encrypt HTTP Challenge Jan 12, 2018

juliens force-pushed the challenge-http branch from 735d199 to f06f528 Compare January 12, 2018 15:44

ldez added the priority/P0 needs hot fix label Jan 12, 2018

juliens force-pushed the challenge-http branch 2 times, most recently from 3fe761c to 0556b6b Compare January 12, 2018 16:29

ldez added WIP and removed WIP contributor/waiting-for-corrections labels Jan 12, 2018

hugglesfox mentioned this pull request Jan 12, 2018

Traefik can't resolve Route53 DNS domain SOA record during ACME dns-route53 record validation #2699

Closed

ldez force-pushed the challenge-http branch 2 times, most recently from bcef1c8 to 23ce35e Compare January 13, 2018 01:43

Luit reviewed Jan 13, 2018

View reviewed changes

docs/user-guide/examples.md Outdated

caServer = "http://172.18.0.1:4000/directory"

entryPoint = "https"

[acme.dsnChallenge]

Copy link

Luit Jan 13, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

typo

ldez force-pushed the challenge-http branch from 23ce35e to 3014e2b Compare January 13, 2018 01:53

kahkhang mentioned this pull request Jan 13, 2018

SSL_ERROR_INTERNAL_ERROR_ALERT on Ingress services kahkhang/kube-linode#72

Closed

ldez force-pushed the challenge-http branch from 3014e2b to e5c2bc0 Compare January 13, 2018 13:50

ldez force-pushed the challenge-http branch 2 times, most recently from 6319c3d to 6d91f55 Compare January 13, 2018 14:33

ldez and others added 5 commits January 15, 2018 14:48

refactor: minor log changes.

1073eed

Modify ACME examples tu use HTTP-01 challenge

827faf2

Code review

7b30a8f

[doc] - fix typo

7936859

refactor: rename files.

ad2c638

traefiker force-pushed the challenge-http branch from f490f10 to ad2c638 Compare January 15, 2018 14:48

traefiker removed the status/4-merge-in-progress label Jan 15, 2018

traefiker merged commit 3e439cc into traefik:v1.5 Jan 15, 2018

traefiker removed the status/3-needs-merge label Jan 15, 2018

traefiker mentioned this pull request Jan 15, 2018

Feature: http-01 support #1832

Closed

Hermsi1337 mentioned this pull request Jan 15, 2018

acme: Could not determine solvers rawmind0/alpine-traefik#74

Closed

traefik locked and limited conversation to collaborators Jan 15, 2018

traefik unlocked this conversation Jan 15, 2018

traefik locked and limited conversation to collaborators Jan 16, 2018

juliens deleted the challenge-http branch January 25, 2018 20:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Let's Encrypt HTTP Challenge #2701

Add Let's Encrypt HTTP Challenge #2701

juliens commented Jan 12, 2018 •

edited by ldez

Loading

emilevauge left a comment

emilevauge Jan 12, 2018

emilevauge Jan 12, 2018

emilevauge Jan 12, 2018

emilevauge Jan 12, 2018

emilevauge Jan 12, 2018

emilevauge Jan 12, 2018

dfeyer commented Jan 12, 2018

Luit Jan 13, 2018

markuslackner commented Jan 13, 2018 •

edited by ldez

Loading

ldez commented Jan 13, 2018 •

edited

Loading

mhajder commented Jan 15, 2018 •

edited

Loading

kruemelro commented Jan 15, 2018

mhajder commented Jan 15, 2018 •

edited by ldez

Loading

ldez commented Jan 15, 2018

mhajder commented Jan 15, 2018

ldez commented Jan 15, 2018

ldez commented Jan 15, 2018

hugglesfox commented Jan 15, 2018

ldez commented Jan 15, 2018

alexandre-leites commented Jan 15, 2018

ldez commented Jan 15, 2018

signaleleven commented Jan 16, 2018

vrosales commented Jan 16, 2018

nmengin commented Jan 16, 2018

ldez commented Jan 20, 2018

Add Let's Encrypt HTTP Challenge #2701

Add Let's Encrypt HTTP Challenge #2701

Conversation

juliens commented Jan 12, 2018 • edited by ldez Loading

What does this PR do?

Motivation

More

Additional Notes

emilevauge left a comment

Choose a reason for hiding this comment

emilevauge Jan 12, 2018

Choose a reason for hiding this comment

emilevauge Jan 12, 2018

Choose a reason for hiding this comment

emilevauge Jan 12, 2018

Choose a reason for hiding this comment

emilevauge Jan 12, 2018

Choose a reason for hiding this comment

emilevauge Jan 12, 2018

Choose a reason for hiding this comment

emilevauge Jan 12, 2018

Choose a reason for hiding this comment

dfeyer commented Jan 12, 2018

Luit Jan 13, 2018

Choose a reason for hiding this comment

markuslackner commented Jan 13, 2018 • edited by ldez Loading

ldez commented Jan 13, 2018 • edited Loading

mhajder commented Jan 15, 2018 • edited Loading

kruemelro commented Jan 15, 2018

mhajder commented Jan 15, 2018 • edited by ldez Loading

ldez commented Jan 15, 2018

mhajder commented Jan 15, 2018

ldez commented Jan 15, 2018

ldez commented Jan 15, 2018

hugglesfox commented Jan 15, 2018

ldez commented Jan 15, 2018

alexandre-leites commented Jan 15, 2018

ldez commented Jan 15, 2018

signaleleven commented Jan 16, 2018

vrosales commented Jan 16, 2018

nmengin commented Jan 16, 2018

ldez commented Jan 20, 2018

juliens commented Jan 12, 2018 •

edited by ldez

Loading

markuslackner commented Jan 13, 2018 •

edited by ldez

Loading

ldez commented Jan 13, 2018 •

edited

Loading

mhajder commented Jan 15, 2018 •

edited

Loading

mhajder commented Jan 15, 2018 •

edited by ldez

Loading